Diff options
| -rwxr-xr-x | tests/t0303-robustness.sh | 26 |
1 file changed, 26 insertions, 0 deletions
diff --git a/tests/t0303-robustness.sh b/tests/t0303-robustness.sh index 841a031..2472bcd 100755 --- a/tests/t0303-robustness.sh +++ b/tests/t0303-robustness.sh @@ -909,4 +909,30 @@ test_expect_success 'blame turns away a binary file' ' test_grep "(<a href=./binblame/blame/file-1.>blame</a>)" tmp ' +# A scanned repository may set its description, owner and section without +# trust, so markup in them has to land escaped on the index and in the meta +# description of its own pages. +test_expect_success 'descriptive values from a scanned repository are escaped' ' + git clone -q --bare repos/rob/.git descscan/d.git && + cat >descscan/d.git/cgitrc <<-\EOF && + desc=desc <x> & "q" '\''s + owner=owner <x> & "q" '\''s + section=section <x> & "q" '\''s + EOF + { + echo "virtual-root=/" && + echo "cache-size=0" && + echo "enable-index-owner=1" && + echo "scan-path=$PWD/descscan" + } >descrc && + cgit_ok descrc "url=" >tmp && + test_grep "<a href=./d.git/.>desc <x> & \"q\" .s</a>" tmp && + test_grep "<a href=./?q=owner+%3Cx%3E+%26+%22q%22+%27s.>owner <x> & \"q\" .s</a>" tmp && + test_grep "class=.reposection.>section <x> & \"q\" .s</td>" tmp && + test_grep ! "<x>" tmp && + cgit_ok descrc "url=d.git/" >tmp && + test_grep "<meta name=.description. content=.desc <x> & "q" 's.>" tmp && + test_grep ! "<x>" tmp +' + test_done |